Link cloaking explained — and when not to use it
Cloaking keeps your short URL in the address bar by loading the destination in a frame. It has real uses and real failure modes.
By ShortFreeURL Team · 4 June 2026
What cloaking does
Instead of redirecting, the server returns a page that loads the destination inside a full-window frame. The visitor sees your short URL in the address bar the whole time. Nothing about the destination changes — it is simply displayed inside your URL.
Why people use it
Affiliate marketers use it to keep long tracking URLs out of sight. Agencies use it so a client-facing link stays on the client's domain. Some teams use it to keep a campaign URL consistent across channels.
The failure mode you must know about
Most large sites send an X-Frame-Options or a frame-ancestors Content-Security-Policy header that forbids being framed. YouTube, Google, Facebook, most banks and most payment providers all refuse. The visitor gets a blank frame. There is no way around this, and no platform can fix it — the destination is deliberately refusing.
Mixed content breaks it too
If your short link is HTTPS and the destination is HTTP, the browser blocks the frame as insecure content. Cloaking only works when both ends are HTTPS.
The honesty question
Cloaking hides the destination from the visitor until after they have committed. For affiliate disclosure and for anything where the destination is the point, that is a real downside. Many teams find that a branded short link alone solves the aesthetic problem without hiding anything.
Test before you ship
Always open a cloaked link in a fresh browser before sending it to anyone. If the frame is blank, switch that link back to a normal redirect — a broken page costs far more than a visible URL.